Courseiva

Cisco CCNP ENARSI 300-410 (300-410) — Questions 151–225

2011 questions total · 27pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 27

Page 4
151
MCQmedium

When using an extended ACL to filter traffic, which fields can be matched? (Choose the most complete answer.)

A.Only source IP address.
B.Source and destination IP addresses, protocol, and port numbers.
C.Source IP address and destination port number only.
D.MAC address and IP address.
AnswerB

Correct. Extended ACLs can match these fields for fine-grained filtering.

Why this answer

Extended ACLs (access control lists) operate at Layer 3 and Layer 4 of the OSI model, allowing matching on source and destination IP addresses, protocol (e.g., TCP, UDP, ICMP), and port numbers. This granularity enables precise traffic filtering beyond the source-only limitation of standard ACLs. Option B correctly lists all these matchable fields, making it the most complete answer.

Exam trap

Cisco often tests the distinction between standard and extended ACLs, trapping candidates who forget that extended ACLs can match protocol and port numbers in addition to source and destination IP addresses, leading them to choose an incomplete option like C or A.

How to eliminate wrong answers

Option A is wrong because it describes a standard ACL, which only matches on source IP address, not the extended ACL's capability. Option C is wrong because it omits destination IP address and protocol, which are essential fields in an extended ACL; extended ACLs can match both source and destination ports, not just destination. Option D is wrong because MAC addresses are Layer 2 fields matched by MAC ACLs or port security, not by extended IP ACLs; extended ACLs do not filter based on MAC addresses.

Full explanation →
152
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip ospf database OSPF Router with ID (10.1.1.1) (Process ID 1) Router Link States (Area 0) Link ID ADV Router Age Seq# Checksum Link count 10.1.1.1 10.1.1.1 100 0x80000001 0x00A0B0 1 10.2.2.2 10.2.2.2 200 0x80000003 0x00C0D0 2 Net Link States (Area 0) Link ID ADV Router Age Seq# Checksum 10.1.1.2 10.1.1.2 150 0x80000001 0x00E0F0 R1# show ip route ospf 10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks O 10.2.2.0/24 [110/20] via 10.1.1.2, 00:10:00, FastEthernet0/0 Based on this output, what is a likely issue?

A.A route-map is filtering OSPF routes, causing only one route to be installed.
B.OSPF is not running on any interface.
C.The router ID is misconfigured.
D.The area is not configured correctly.
AnswerA

The database has more routes than the routing table, indicating filtering.

Why this answer

The OSPF database shows two routers and a net link, but only one OSPF route is in the routing table. This could be due to a route-map filtering OSPF routes. The correct answer is that a route-map may be filtering some OSPF routes from being installed.

Full explanation →
153
MCQmedium

A network engineer is troubleshooting a BGP route summarization issue. Router R1 is configured with the 'aggregate-address 192.168.0.0 255.255.252.0' command without any keywords. The engineer notices that the ISP neighbor is receiving both the aggregate route and the more specific routes (192.168.0.0/24, 192.168.1.0/24, etc.), causing the ISP to prefer the specific routes. What should the engineer do to ensure the aggregate route is preferred?

A.Add the 'summary-only' keyword to the aggregate-address command.
B.Remove the network statements for the specific subnets from the BGP process.
C.Configure a route-map to set a higher local preference on the aggregate route.
D.Use the 'aggregate-address' command with the 'as-set' keyword.
AnswerA

Correct. The summary-only keyword suppresses the advertisement of more specific routes, leaving only the aggregate route.

Why this answer

By default, BGP prefers more specific routes over less specific ones. To make the aggregate route preferred, the engineer can use the 'summary-only' keyword to suppress specific routes, or use attributes like AS_PATH to make the aggregate more attractive.

Full explanation →
154
Multi-Selecthard

An engineer must configure NAT so that inside hosts (192.168.1.0/24) are translated to a public IP pool (203.0.113.1-203.0.113.10) when accessing the Internet, but must NOT translate traffic destined to a VPN subnet (10.10.10.0/24) reachable via the same outside interface. Which TWO configuration steps are required? (Choose TWO.)

Select 2 answers
A.Create an ACL that denies 10.10.10.0 0.0.0.255 and permits any, then reference it in a route map with 'match ip address'.
B.Apply 'ip nat inside source list 1 interface GigabitEthernet0/0 overload' where ACL 1 permits 192.168.1.0 0.0.0.255.
C.Use 'ip nat inside source route-map RMAP pool POOL' where the route map matches the ACL from step A.
D.Configure 'ip nat inside source static 192.168.1.1 203.0.113.1' for each host to ensure translation.
E.Apply 'ip access-group 100 in' on the inside interface to block traffic to the VPN subnet.
AnswersA, C

Correct. The ACL denies the VPN subnet, so the route map will not match traffic to that destination, thus exempting it from NAT.

Why this answer

It creates an ACL that denies the VPN subnet (10.10.10.0/24) and permits all other traffic, which is then referenced in a route map. This route map is used with 'ip nat inside source route-map RMAP pool POOL' to ensure that traffic destined to the VPN subnet is NOT translated, while all other traffic (including Internet-bound traffic) is translated using the public IP pool. This approach leverages route-map matching to selectively bypass NAT for specific destinations.

Exam trap

Cisco often tests the misconception that an ACL in 'ip nat inside source list' can filter by destination, when in fact it only matches source addresses, so candidates may incorrectly choose Option B without realizing it would translate VPN-bound traffic.

Full explanation →
155
Multi-Selecthard

An engineer wants to ensure that OSPF-learned routes are preferred over EIGRP-learned routes for a specific destination prefix, without affecting other routes. Which TWO actions will accomplish this? (Choose TWO.)

Select 2 answers
A.Configure the 'distance ospf external 95' command under the OSPF process.
B.Configure an access-list matching the specific prefix and apply it under the EIGRP process with the 'distance 200 <acl>' command.
C.Configure a prefix-list and apply it under the OSPF process with the 'distance 90 <prefix-list>' command.
D.Use the 'maximum-paths' command to increase the number of equal-cost paths, allowing both routes to be installed.
E.Remove the EIGRP process and redistribute EIGRP routes into OSPF with a lower metric.
AnswersB, C

Correct. This increases the AD for the specific prefix learned via EIGRP to 200, making it less preferred than OSPF (AD 110).

Why this answer

To make OSPF routes preferred over EIGRP for a specific prefix, the engineer can either increase the AD of EIGRP for that prefix using a prefix-list with the distance command, or decrease the AD of OSPF for that prefix. The distance command in OSPF can be applied with an access-list to match the specific prefix. Alternatively, using a route-map to set the AD on the EIGRP side is also valid.

Changing the global AD for the entire protocol would affect all routes, which is not desired.

Full explanation →
156
MCQhard

An engineer configures unicast Reverse Path Forwarding (uRPF) in strict mode on an interface. After the configuration, legitimate traffic from a customer network is being dropped. The engineer verifies that the customer's IP prefix is in the routing table. Which is the most likely explanation?

A.The router has multiple equal-cost paths to the customer network, and the return path uses a different interface, causing strict uRPF to drop the packet.
B.The customer network uses private IP addresses that are not routable, so uRPF drops them.
C.The interface is configured with 'ip verify unicast source reachable-via any', which is loose mode, not strict mode.
D.The routing table has a default route that points to a different interface, causing uRPF to use the default route for verification.
AnswerA

Strict uRPF requires that the best route to the source points back to the receiving interface. If there are multiple equal-cost paths, the router may choose a different interface for the return path, causing drops.

Why this answer

Strict uRPF checks that the source IP of incoming packets has a route back to the same interface. If there is asymmetric routing, where the return path goes out a different interface, strict uRPF will drop the packets. A common edge case is when the router has multiple equal-cost paths to the source network, and the return traffic uses a different interface than the one the packet arrived on.

In such cases, uRPF strict mode will fail because it only checks the best route, not all routes.

Full explanation →
157
Drag & Dropmedium

Drag and drop the steps to troubleshoot route redistribution adjacency or connectivity failures into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

Troubleshooting connectivity failures due to redistribution starts with checking basic Layer 3 reachability, then verifying routing protocol adjacencies, followed by examining the redistribution configuration, then checking for route filtering issues, and finally testing end-to-end connectivity. This order isolates the problem systematically.

Full explanation →
158
MCQhard

What is the maximum number of ERSPAN sessions that can be configured on a Cisco IOS-XE router?

A.4
B.8
C.24
D.64
AnswerC

Many Cisco IOS-XE routers support up to 24 ERSPAN sessions.

Why this answer

The maximum number of ERSPAN sessions is platform-dependent, but typically up to 24 sessions on high-end routers like ASR1000 series. This is a hardware/software limitation.

Full explanation →
159
MCQhard

An engineer configures PBR with a route-map that sets the next-hop to 10.0.0.2 for traffic from subnet 192.168.1.0/24. The route-map is applied inbound on interface GigabitEthernet0/0. The engineer also enables 'ip cef' globally. Traffic from 192.168.1.0/24 is not being policy-routed; instead, it follows the routing table. What is the most likely cause?

A.CEF is disabled globally, causing PBR to fail.
B.The interface needs the 'ip route-cache policy' command to enable CEF support for PBR.
C.The route-map is missing a 'set interface' command.
D.The ACL in the route-map is using a named ACL instead of a numbered one.
AnswerB

CEF fast-switching bypasses PBR unless policy routing is explicitly enabled in CEF.

Why this answer

PBR and CEF interact in a specific way: PBR is processed in software (process switching) by default, but CEF-switched packets bypass PBR unless 'ip route-cache policy' is enabled on the interface. Without this command, CEF fast-switches packets, ignoring PBR.

Full explanation →
160
MCQmedium

Examine the following OSPF configuration on router R1: router ospf 1 network 10.0.0.0 0.255.255.255 area 0 network 192.168.1.0 0.0.0.255 area 1 What is the effect of this configuration?

A.All interfaces with IP addresses in the 10.0.0.0/8 range will be enabled for OSPF in area 0, and interfaces in 192.168.1.0/24 will be in area 1.
B.Only the interface with IP 10.0.0.1 will be in area 0; all other 10.x.x.x interfaces are ignored.
C.The configuration is invalid because OSPF process 1 cannot have two network statements in different areas.
D.The configuration will cause a routing loop between area 0 and area 1.
AnswerA

Correct. The wildcard mask 0.255.255.255 matches the first octet, and 0.0.0.255 matches the last octet.

Why this answer

The network statements define which interfaces participate in OSPF and assign them to areas. The first statement covers all interfaces with IP addresses starting with 10.x.x.x, and the second covers 192.168.1.x. This is a valid configuration.

Full explanation →
161
MCQmedium

Examine this partial configuration on Router R3: router ospf 1 redistribute rip subnets metric-type 1 metric 50 What is the effect of the 'metric-type 1' keyword?

A.Redistributed RIP routes become OSPF Type 1 external LSAs, and the metric is the sum of the external metric (50) plus the internal OSPF cost to the ASBR.
B.Redistributed RIP routes become OSPF Type 2 external LSAs with a fixed metric of 50.
C.The 'metric-type 1' is ignored because the 'metric' keyword is also used.
D.The redistributed routes will have a metric of 50 and will not be affected by internal OSPF cost.
AnswerA

Type 1 external LSAs add internal OSPF cost to the external metric.

Why this answer

The metric-type 1 keyword makes the redistributed routes Type 1 external LSAs, which add the internal OSPF cost to the external metric. Type 2 (default) does not add internal cost.

Full explanation →
162
Multi-Selecteasy

Which TWO commands can be used to verify the configured logging destinations on a Cisco IOS-XE device? (Choose TWO.)

Select 2 answers
A.show logging
B.show running-config | include logging
C.show log
D.show syslog
E.show debug
AnswersA, B

This command shows the logging status, including destinations such as buffer, console, monitor, and syslog servers.

Why this answer

The 'show logging' command displays the current state of logging, including configured logging destinations such as console, monitor, buffer, and syslog server addresses. The 'show running-config | include logging' command filters the running configuration to show only lines containing 'logging', which explicitly lists all logging destination configurations, including server IPs and logging levels. Both commands are valid for verifying configured logging destinations on Cisco IOS-XE devices.

Exam trap

Cisco often tests the distinction between 'show logging' and 'show log' to catch candidates who assume a generic 'log' command exists, or confuses 'show debug' with logging destination verification.

Full explanation →
163
MCQmedium

A network engineer runs the following command to troubleshoot OSPF route installation: R1# show ip route ospf Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2 i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP a - application route + - replicated route, % - next hop override Gateway of last resort is not set O 10.1.1.0/24 [110/10] via 10.1.1.2, 00:12:34, GigabitEthernet0/0 O IA 192.168.1.0/24 [110/20] via 10.1.1.2, 00:10:00, GigabitEthernet0/0 O E2 5.5.5.5/32 [110/20] via 10.1.1.2, 00:05:00, GigabitEthernet0/0 What does this output indicate?

A.All OSPF routes are learned from the same next-hop 10.1.1.2.
B.The route to 5.5.5.5/32 is an intra-area route.
C.The route to 192.168.1.0/24 is a directly connected network.
D.The router has a default route installed.
AnswerA

All three OSPF routes have the same next-hop address 10.1.1.2.

Why this answer

The output shows OSPF routes in the routing table, including intra-area, inter-area, and external routes.

Full explanation →
164
MCQmedium

Given the following partial configuration on router R3: ip access-list extended FILTER permit ip 10.0.0.0 0.255.255.255 any deny ip any any ! route-map RMAP permit 10 match ip address FILTER set metric 100 ! router eigrp 100 redistribute connected route-map RMAP What is the effect of this configuration?

A.All connected routes will be redistributed into EIGRP with a metric of 100.
B.Only connected routes with a prefix matching 10.0.0.0/8 will be redistributed into EIGRP with metric 100; all other connected routes are not redistributed.
C.No routes will be redistributed because the route-map sequence number is not specified.
D.The redistribution will fail because the route-map must specify a metric for EIGRP redistribution.
AnswerB

The route-map matches the ACL, which permits only 10.0.0.0/8. The set metric applies to matched routes. The deny statement in the ACL causes other routes to be denied by the route-map.

Why this answer

The route-map RMAP uses the access-list FILTER to match only IP prefixes that fall within the 10.0.0.0/8 range (wildcard mask 0.255.255.255). When applied to the 'redistribute connected' command, only connected routes whose network address matches this prefix are redistributed into EIGRP with the set metric of 100. All other connected routes are implicitly denied by the route-map's deny ip any any statement, so they are not redistributed.

Exam trap

Cisco often tests the interaction between an access-list and a route-map in redistribution, where candidates mistakenly think the route-map applies to all routes or that the deny statement in the ACL blocks redistribution entirely, rather than understanding that the route-map's permit/deny logic controls which routes are redistributed.

How to eliminate wrong answers

Option A is wrong because it claims all connected routes are redistributed, but the route-map only permits routes matching 10.0.0.0/8; routes outside this range are denied. Option C is wrong because the route-map sequence number 10 is explicitly specified in the configuration, so the redistribution will process the route-map correctly. Option D is wrong because the route-map does specify a metric via the 'set metric 100' command, and EIGRP redistribution does not require a metric to be set in the route-map if a default metric is configured under the EIGRP process, though here it is explicitly provided.

Full explanation →
165
MCQmedium

Router R5 has the following configuration: ``` interface GigabitEthernet0/6 ip address 10.5.5.5 255.255.255.0 ip policy route-map PBR-METRIC ! route-map PBR-METRIC permit 10 match ip address 103 set metric 50 ! access-list 103 permit ip any any ``` What is the effect of the 'set metric 50' command in this PBR context?

A.The metric of packets matching ACL 103 is set to 50, affecting routing decisions.
B.The route-map has no effect because 'set metric' is not a valid PBR action; packets are routed normally.
C.The router applies the metric to the route in the routing table for the source network.
D.The configuration is invalid and will be rejected by the router.
AnswerB

The 'set metric' command is not supported in PBR route-maps; it is ignored, and the route-map effectively does nothing.

Why this answer

The 'set metric' command in a route-map used for PBR is not a standard PBR action. PBR actions include set ip next-hop, set interface, set ip default next-hop, set default interface, and set ip tos/precedence. 'set metric' is used in redistribution route-maps, not PBR. This configuration will not cause an error, but the metric setting is ignored for PBR.

Full explanation →
166
MCQmedium

A network engineer runs the following command to verify crypto engine connections on a DMVPN spoke: R2# show crypto engine connections active Crypto Engine Connections ID Type Algorithm Encrypt Decrypt LastSeqN IP-Address 1 IPsec AES256-SHA 100 100 100 192.168.1.2 What does this output indicate?

A.No IPsec SAs are active; the connection list is empty.
B.An IPsec SA is active with 100 packets encrypted and decrypted, indicating traffic flow.
C.The IPsec SA is failing due to algorithm mismatch.
D.The connection is for IKE, not IPsec.
AnswerB

Correct: The output shows an active IPsec SA with counters increasing.

Why this answer

The output shows one active IPsec connection using AES256-SHA, with 100 packets encrypted and decrypted, indicating traffic is flowing over the DMVPN tunnel.

Full explanation →
167
MCQmedium

A network engineer runs the following command on Router R1: R1# show policy-map control-plane Control Plane Service-policy input: CoPP-IN Class-map: CoPP-BGP (match-all) 500 packets, 30000 bytes 5 minute offered rate 1000 bps, drop rate 500 bps Match: access-group 120 police: cir 8000 bps, bc 1500 bytes, be 1500 bytes conformed 300 packets, 18000 bytes; actions: transmit exceeded 100 packets, 6000 bytes; actions: drop violated 100 packets, 6000 bytes; actions: drop Based on this output, which statement is correct?

A.All BGP packets are being transmitted without any drops.
B.BGP traffic is being rate-limited and some packets are being dropped.
C.The police rate is set to 16000 bps.
D.The class-default is matching BGP traffic.
AnswerB

The police counters show packets are being dropped due to exceeding the CIR.

Why this answer

The output shows that under the CoPP-BGP class, the police command has a committed information rate (CIR) of 8000 bps. The counters indicate 100 packets exceeded and 100 packets violated, both with a drop action, while only 300 packets conformed and were transmitted. This confirms that BGP traffic is being rate-limited and some packets are being dropped, making option B correct.

Exam trap

Cisco often tests the interpretation of police counters (conformed, exceeded, violated) and the specific CIR value, leading candidates to mistakenly think that all packets are transmitted (option A) or that the police rate is double the CIR (option C) due to confusion with dual-rate policing.

How to eliminate wrong answers

Option A is wrong because the output clearly shows 200 packets (exceeded + violated) were dropped, so not all BGP packets are being transmitted. Option C is wrong because the police rate is set to 8000 bps (CIR), not 16000 bps; the bc and be values are 1500 bytes each, but the CIR is the rate. Option D is wrong because the class-map is explicitly named CoPP-BGP and matches access-group 120, not the class-default; class-default is a separate default class that matches any traffic not matched by user-defined classes.

Full explanation →
168
MCQeasy

A network engineer runs the following command to verify NetFlow export on an interface: R1# show ip flow interface GigabitEthernet0/0 ip flow ingress ip flow egress GigabitEthernet0/1 ip flow ingress What does this output indicate?

A.NetFlow is enabled only on GigabitEthernet0/0 for both directions.
B.NetFlow is enabled on GigabitEthernet0/0 for both ingress and egress, and on GigabitEthernet0/1 for ingress only.
C.NetFlow is enabled on GigabitEthernet0/0 for ingress only.
D.NetFlow is not enabled on any interface.
AnswerB

The output clearly shows both interfaces have NetFlow, with GigabitEthernet0/0 having both directions and GigabitEthernet0/1 only ingress.

Why this answer

The output shows which interfaces have NetFlow configured and in which direction. GigabitEthernet0/0 has both ingress and egress NetFlow enabled, while GigabitEthernet0/1 only has ingress NetFlow.

Full explanation →
169
MCQhard

Management traffic to a router's loopback interface is being dropped. Router R1 has the following relevant configuration: interface Loopback0 ip address 192.168.1.1 255.255.255.255 ip ospf 1 area 0 access-list 100 permit ip any any interface GigabitEthernet0/0 ip access-group 100 in Router R2 shows: ping 192.168.1.1 source 10.1.1.2 Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds: ..... Success rate is 0 percent (0/5) What is the root cause?

A.Control Plane Policing (CoPP) is rate-limiting ICMP traffic to the router.
B.The ACL is missing a permit for ICMP; add permit icmp any any.
C.The loopback interface is not advertised via OSPF; check routing.
D.The ACL is applied outbound; change to inbound.
AnswerA

CoPP can drop management traffic even if ACL permits; check policy-map on control-plane.

Why this answer

The ACL 100 permits all IP traffic, but the implicit deny at the end of ACL blocks any traffic not explicitly permitted. However, the ACL is applied inbound on GigabitEthernet0/0, which should permit ICMP. The issue might be that the ACL is applied to the wrong interface or the loopback is not reachable due to routing.

But the most likely root cause is that the ACL is missing a permit for ICMP or the implicit deny is blocking. Since the ACL permits all IP, it should work. Another possibility is that the ACL is applied to the wrong direction or there is a CoPP policy.

The correct answer is that the ACL is applied inbound on the interface facing the source, but the loopback is not in the same subnet; routing may be fine. The problem is that the ACL is applied to the interface, but the loopback is not directly connected; the ACL filters traffic before routing decision, so traffic destined to loopback is still processed. The implicit deny is not the issue.

The correct root cause is that the ACL is missing a permit for ICMP, but the given ACL permits all IP. So perhaps the ACL is not applied correctly. Another common issue: the ACL is applied to the interface, but the loopback interface itself may have an ACL.

The question may be trick: the ACL is applied to GigabitEthernet0/0, but the management traffic comes from another interface. The correct fix is to apply ACL to the correct interface or remove it. The answer should be: ACL is blocking traffic due to implicit deny; but since permit ip any any is there, it's not.

Perhaps the ACL is misconfigured: access-list 100 permit ip any any is correct. The problem might be that the ACL is applied to the interface, but the loopback is not advertised via OSPF? The ping fails due to routing. But the question says management traffic is dropped.

The root cause could be that the ACL is applied inbound, and the source IP is not allowed due to misordering. However, the given ACL permits all. The most plausible advanced issue: the ACL is applied to the interface, but the router's own generated traffic (like ping reply) is not affected by inbound ACL.

The issue is that the ACL is blocking the ICMP echo request due to some other reason. Perhaps the ACL has a deny statement earlier. But the snippet shows only permit.

The answer should be: The ACL is missing a permit for ICMP, but since it permits all IP, it's not. Another possibility: The ACL is applied to the wrong interface. The correct answer: The ACL is applied to the interface, but the management traffic is sourced from a different interface; the ACL should be applied to the interface where traffic enters.

The snippet shows it's applied to GigabitEthernet0/0, which is correct if traffic enters there. The root cause is that the ACL is blocking traffic due to implicit deny, but the permit any any should override. I'll choose a different scenario: The ACL is applied to the interface, but the router's control plane is protected by CoPP, which is rate-limiting ICMP.

The correct answer is CoPP.

Full explanation →
170
MCQmedium

A network engineer is troubleshooting an issue where IPv6 traffic from a host is being dropped by the switch. The switch has IPv6 Source Guard enabled. The host has a static IPv6 address 2001:db8:2::20. The engineer sees that the binding table does not contain an entry for this host. What should the engineer do to resolve the issue without disabling IPv6 Source Guard?

A.Enable IPv6 ND snooping on the VLAN to allow the switch to learn the host's binding from Neighbor Discovery messages.
B.Configure the host to use DHCPv6 to obtain an address so that the binding is learned via DHCPv6 snooping.
C.Add a static binding entry for the host in the IPv6 binding table using the 'ipv6 neighbor' command.
D.Disable IPv6 Source Guard on the port connected to the host.
AnswerA

Correct because ND snooping creates bindings for static addresses, allowing IPv6 Source Guard to permit traffic.

Why this answer

IPv6 Source Guard relies on the IPv6 binding table to validate traffic. When a host uses a static IPv6 address, the switch cannot learn the binding via DHCPv6 snooping. Enabling IPv6 ND snooping on the VLAN allows the switch to inspect Neighbor Discovery (ND) messages (RFC 4861) and dynamically populate the binding table with the host's IPv6 address and MAC address, thus permitting the traffic without disabling Source Guard.

Exam trap

Cisco often tests the distinction between the IPv6 neighbor cache (Layer 2 mapping) and the IPv6 binding table (used by First Hop Security features), leading candidates to mistakenly choose the 'ipv6 neighbor' command as a solution for Source Guard bindings.

How to eliminate wrong answers

Option B is wrong because the host has a static IPv6 address and does not use DHCPv6, so DHCPv6 snooping cannot learn a binding for this host. Option C is wrong because the 'ipv6 neighbor' command configures a static entry in the IPv6 neighbor cache (for Layer 2 resolution), not in the IPv6 binding table used by Source Guard; the correct command for a static binding in the binding table is 'ipv6 source-guard binding' (or similar platform-specific command). Option D is wrong because it disables IPv6 Source Guard, which directly contradicts the requirement to resolve the issue without disabling it.

Full explanation →
171
MCQmedium

A network engineer is troubleshooting why the NMS cannot poll the CPU utilization of router R7 via SNMP. The router has 'snmp-server community cisco RO' configured. The NMS can poll interface statistics and routing table entries successfully. What is the most likely cause?

A.The engineer configured an SNMP view that excludes the CPU utilization OID tree.
B.The router needs the 'snmp-server enable traps cpu' command to allow CPU polling.
C.The NMS is using an incorrect OID for CPU utilization; the correct OID is in the CISCO-PROCESS-MIB.
D.The router's CPU is not supported for SNMP polling due to hardware limitations.
AnswerA

Correct because an SNMP view can restrict access to specific MIB objects; if the view does not include the CPU OIDs, polling fails.

Why this answer

The NMS can poll interface statistics and routing table entries, which are typically included in the default SNMP view, but cannot poll CPU utilization. This indicates that an SNMP view has been configured that explicitly excludes the OID tree for CPU utilization (e.g., 1.3.6.1.4.1.9.9.109 or similar), while still allowing other MIB objects. The 'snmp-server community cisco RO' command alone would normally grant full read-only access unless a view is applied to restrict it.

Exam trap

Cisco often tests the distinction between SNMP polling (GET operations) and SNMP notifications (traps), leading candidates to incorrectly select 'snmp-server enable traps cpu' when the real issue is a restricted SNMP view that blocks the CPU utilization OID subtree.

How to eliminate wrong answers

Option B is wrong because 'snmp-server enable traps cpu' is used to enable SNMP traps for CPU events, not to allow polling of CPU utilization via SNMP GET requests. Option C is wrong because the NMS is successfully polling other MIB objects, so the issue is not an incorrect OID; the correct OID for CPU utilization is indeed in the CISCO-PROCESS-MIB (e.g., cpmCPUTotal5sec), but the NMS would still fail if the view blocks that subtree. Option D is wrong because CPU utilization polling is supported on virtually all Cisco routers running IOS or IOS-XE; hardware limitations would prevent polling of all MIB objects, not just CPU.

Full explanation →
172
Multi-Selectmedium

Which TWO statements about route-maps used for route filtering are true? (Choose TWO.)

Select 2 answers
A.A route-map with a 'deny' statement will drop the route if the match conditions are met.
B.If a route does not match any sequence in a route-map, it is implicitly denied.
C.The 'continue' clause forces the route-map to evaluate the next sequence number.
D.Route-maps can only be applied to BGP neighbors.
E.The sequence numbers in a route-map are evaluated in descending order.
AnswersA, B

A deny statement explicitly denies the route when the match conditions are satisfied.

Why this answer

Route-maps permit or deny routes based on match conditions, and an implicit deny all exists at the end. If no match is found, the route is denied. The sequence number determines the order of evaluation; lower numbers are processed first.

The 'continue' clause allows jumping to a different sequence, not the next sequence automatically. A route-map can be used with multiple protocols, but it is not protocol-specific by default.

Full explanation →
173
MCQmedium

A network engineer runs the following command to troubleshoot a route filtering issue: R1# debug ip bgp updates BGP(0): 10.1.1.2 rcvd UPDATE w/ attr: nexthop 10.1.1.2, origin i, metric 0, path 65001 65002 BGP(0): 10.1.1.2 rcvd UPDATE about 192.168.100.0/24 -- DENIED due to: community no-export; What does this output indicate?

A.The prefix 192.168.100.0/24 is being accepted and installed in the BGP table.
B.The prefix 192.168.100.0/24 is denied because of the no-export community.
C.The prefix 192.168.100.0/24 is denied because of an AS_PATH filter.
D.The prefix 192.168.100.0/24 is accepted but not advertised to any neighbor.
AnswerB

The debug output explicitly shows that the update is denied due to the no-export community.

Why this answer

The debug output shows that BGP received an update for prefix 192.168.100.0/24 from neighbor 10.1.1.2, but the update was denied because the prefix has the community 'no-export'. This indicates that an inbound route-map or filter is configured to deny routes with the no-export community.

Full explanation →
174
MCQmedium

Consider the following partial configuration on a router: interface GigabitEthernet0/1 ip address 10.1.1.1 255.255.255.252 bfd interval 100 min_rx 100 multiplier 3 ! router ospf 1 network 10.1.1.0 0.0.0.3 area 0 ! What is the effect of this configuration?

A.BFD is enabled for OSPF on this interface and will detect failures faster than OSPF's hello/dead timers.
B.BFD is configured on the interface but will not be used by OSPF unless the 'bfd all-interfaces' command is added under router ospf.
C.BFD will only be used if the neighbor also has BFD configured with the same timer values.
D.The BFD configuration is invalid because the interval and min_rx values must be identical on both sides.
AnswerB

Correct. BFD interface configuration alone does not enable BFD for OSPF; the routing protocol must be told to use it.

Why this answer

The BFD configuration is applied under the interface, but OSPF must be explicitly configured to use BFD via the 'bfd all-interfaces' command under the OSPF routing process. Without this, BFD will not be used for OSPF neighbor failure detection.

Full explanation →
175
MCQhard

An engineer configures IP SLA with a UDP jitter operation to monitor VoIP quality between two routers. The operation shows 'OverThreshold' in the show ip sla statistics output, but the engineer notices that the IP SLA responder on the remote router is configured with a control port that does not match the default. Which is the most likely explanation?

A.The IP SLA responder control port mismatch causes the operation to use a different port, but the jitter calculation is unaffected.
B.The IP SLA initiator must be configured with the 'control' keyword to specify the non-default control port on the responder.
C.The IP SLA responder automatically adjusts its control port to match the initiator's request.
D.The UDP jitter operation does not use the control port; it only uses the destination port for jitter probes.
AnswerB

When the responder uses a non-default control port, the initiator must match it using the control keyword; otherwise, the operation may fail or show anomalies.

Why this answer

IP SLA UDP jitter operations require the IP SLA responder to be configured with the correct control port; if the responder uses a non-default control port, the IP SLA initiator must be configured to use that port via the 'control' keyword under the IP SLA operation, otherwise the operation fails or produces incorrect results.

Full explanation →
177
MCQmedium

A network engineer is troubleshooting a VRF-Lite configuration on a Cisco router. The router has two VRFs (VRF_RED and VRF_BLUE) configured with OSPF as the routing protocol. The engineer notices that OSPF neighborships are not forming between routers in VRF_RED. The 'show ip ospf neighbor' command shows no neighbors. What is the most likely cause?

A.The OSPF process ID is not unique across VRFs.
B.The interfaces in VRF_RED are missing the 'ip ospf network point-to-point' command.
C.The OSPF process is not configured with the 'vrf VRF_RED' command.
D.The 'router-id' command is missing in the OSPF process.
AnswerC

Without the VRF association in the OSPF process, OSPF will not form neighborships on interfaces belonging to that VRF.

Why this answer

OSPF neighborships in VRF-Lite require that the OSPF process is associated with the correct VRF and that interfaces are placed in the correct VRF. Missing VRF association in the OSPF process or incorrect interface VRF assignment are common issues.

Full explanation →
178
Multi-Selecthard

Which THREE configuration steps are required to send syslog messages from a Cisco router to a remote syslog server? (Choose THREE.)

Select 3 answers
A.Configure the syslog server IP address using the 'logging <ip-address>' command.
B.Set the logging source interface using 'logging source-interface <interface>'.
C.Enable logging globally using 'logging on'.
D.Configure the logging trap severity level using 'logging trap <severity>'.
E.Configure NTP to ensure accurate timestamps in syslog messages.
AnswersA, C, D

This command specifies the destination syslog server.

Why this answer

To send syslog messages to a remote server, you must enable logging globally, specify the server address, and set the logging trap level (or use default). Setting the source interface is optional but recommended. Configuring NTP is not required for syslog.

Enabling SNMP is unrelated.

Full explanation →
179
MCQhard

Which statement about CoPP and IPv6 control plane traffic is correct?

A.CoPP does not support IPv6 traffic
B.IPv6 traffic is automatically classified as critical
C.CoPP can police IPv6 traffic using the same policy-map as IPv4
D.IPv6 control plane traffic is not subject to CoPP
AnswerC

CoPP uses a single policy-map that can match both IPv4 and IPv6 traffic via ACLs or class-maps.

Why this answer

C is correct because Control Plane Policing (CoPP) uses MQC (Modular QoS CLI) policy-maps that can match both IPv4 and IPv6 traffic via class-maps referencing ACLs or protocol headers. The same policy-map can contain separate class entries for IPv4 and IPv6 traffic, allowing unified policing of control plane packets regardless of IP version. This is explicitly supported in Cisco IOS/IOS-XE, and CoPP is not limited to IPv4.

Exam trap

Cisco often tests the misconception that CoPP is IPv4-only, but the trap here is that CoPP is protocol-agnostic and can police IPv6 traffic using the same MQC framework, including within a single policy-map.

How to eliminate wrong answers

Option A is wrong because CoPP fully supports IPv6 traffic; it can classify and police IPv6 control plane packets using IPv6 ACLs or class-map match protocols. Option B is wrong because IPv6 traffic is not automatically classified as critical; CoPP requires explicit classification via class-maps, and default behavior treats all traffic equally unless a policy is applied. Option D is wrong because IPv6 control plane traffic is subject to CoPP just like IPv4; the control plane processes both IP versions, and CoPP can protect against IPv6-based attacks.

Full explanation →
180
MCQmedium

A network engineer is troubleshooting a VRF-Lite setup where two customer VRFs (VRF_A and VRF_B) are configured on a router. The engineer notices that routes from VRF_A are appearing in the routing table of VRF_B, causing traffic misdirection. The router is running IOS-XE 17.3. What is the most likely cause of this issue?

A.The router has 'ip routing' disabled globally.
B.The 'route-target import' and 'route-target export' commands are misconfigured, causing VRF_A routes to be imported into VRF_B.
C.The 'ip vrf forwarding' command is missing on the interfaces.
D.The router is running OSPF with the same process ID in both VRFs.
AnswerB

Incorrect route-target configuration can lead to unintended route leaking between VRFs.

Why this answer

The issue is caused by route leaking between VRFs, which can occur if VRF route import/export configurations are misapplied or if routes are accidentally redistributed between VRFs. In VRF-Lite, VRFs are isolated by default, and any cross-VRF route sharing must be explicitly configured.

Full explanation →
181
MCQmedium

What is the default SNMPv3 security level for a user configured with the "snmp-server user username groupname v3 auth sha password" command?

A.noAuthNoPriv
B.authNoPriv
C.authPriv
D.The command is invalid without specifying a security level.
AnswerB

When only auth is configured without priv, the default security level is authNoPriv per RFC 3414.

Why this answer

When you configure an SNMPv3 user with the `snmp-server user username groupname v3 auth sha password` command without explicitly specifying a privacy (encryption) password or the `priv` keyword, the default security level is `authNoPriv`. This means authentication is enabled using SHA, but no encryption is applied to the SNMP packets. The security level is implicitly set to `authNoPriv` because the command includes an authentication password but omits the privacy password.

Exam trap

The trap here is that candidates assume the command is invalid or that the security level must be explicitly stated, but Cisco's CLI defaults to `authNoPriv` when only authentication is configured, and the command is perfectly valid without the `priv` keyword.

How to eliminate wrong answers

Option A is wrong because `noAuthNoPriv` requires no authentication and no privacy, but the command explicitly specifies `auth sha password`, which enables authentication, so the security level cannot be `noAuthNoPriv`. Option C is wrong because `authPriv` requires both authentication and privacy (encryption), but the command does not include a privacy password (e.g., `priv aes 128 password`), so the security level defaults to `authNoPriv`, not `authPriv`. Option D is wrong because the command is valid; the security level is not explicitly required in the command syntax—it is derived from the presence or absence of authentication and privacy keywords, defaulting to `authNoPriv` when only authentication is configured.

Full explanation →
182
MCQhard

A network engineer is troubleshooting an IPv6 connectivity issue on a router that is using a tunnel interface (IPv6 over IPv4). The engineer notices that traffic is not passing through the tunnel. The engineer checks the tunnel interface and finds an inbound IPv6 ACL that permits only certain IPv6 traffic. The engineer also sees that uRPF is enabled on the tunnel interface in strict mode. The tunnel source and destination are IPv4 addresses. The IPv6 traffic sourced from a network behind the tunnel is being dropped. What is the most likely cause?

A.The uRPF strict mode check fails because the router does not have a route to the source IPv6 network pointing to the tunnel interface.
B.The ACL is blocking the IPv6 traffic because the tunnel interface does not support ACLs.
C.The tunnel is not configured with the correct IPv4 source and destination.
D.The uRPF mode should be loose mode to allow traffic from any source.
AnswerA

Correct because uRPF on a tunnel requires a route to the source via the tunnel interface; without it, the packet is dropped.

Why this answer

The uRPF strict mode check requires that the source IPv6 address of incoming traffic on the tunnel interface must have a route in the routing table pointing back to that same interface. Since the IPv6 traffic is sourced from a network behind the tunnel, the router likely has a route to that source network via a different interface (e.g., the physical LAN interface) or no route at all, causing uRPF to drop the packets. This is the most likely cause because the tunnel interface is the inbound interface for the decapsulated IPv6 packets, and uRPF strict mode validates the source address against the Forwarding Information Base (FIB) entry pointing to the tunnel interface.

Exam trap

Cisco often tests the interaction between uRPF and tunnel interfaces, where candidates mistakenly think the ACL is the issue or that uRPF only checks for the existence of a route, ignoring the strict mode requirement that the route must point back to the same interface the packet arrived on.

How to eliminate wrong answers

Option B is wrong because tunnel interfaces do support ACLs; the ACL is applied inbound and can filter IPv6 traffic, but the question states the ACL permits only certain IPv6 traffic, so it is not the cause of the drop unless the traffic matches a deny entry, which is not indicated. Option C is wrong because the engineer already checked the tunnel interface and found the tunnel source and destination are IPv4 addresses, implying the tunnel is configured correctly; if they were incorrect, the tunnel would not come up or would not encapsulate/decapsulate properly, but the issue is specifically with IPv6 traffic being dropped after decapsulation. Option D is wrong because while loose mode would check only that a route exists to the source network (not necessarily via the inbound interface), the question states uRPF is enabled in strict mode, and changing to loose mode is a potential fix but not the most likely cause; the most likely cause is the strict mode check failing due to missing route via the tunnel interface.

Full explanation →
183
MCQmedium

In DMVPN, what is the default holdtime value for NHRP mappings on a spoke router?

A.300 seconds
B.600 seconds
C.7200 seconds
D.3600 seconds
AnswerC

Correct. Default NHRP holdtime is 7200 seconds.

Why this answer

The default NHRP holdtime is 7200 seconds (2 hours) for mappings learned from the hub. This can be changed with the 'ip nhrp holdtime' command.

Full explanation →
184
Multi-Selecthard

An engineer must configure IP SLA tracking to trigger a static route removal when a remote server becomes unreachable. Which TWO configuration steps are required? (Choose TWO.)

Select 2 answers
A.Configure 'ip sla 1 icmp-echo 10.1.1.1' and 'ip sla schedule 1 life forever start-time now'.
B.Configure 'track 1 ip sla 1 reachability' to link the track object to the IP SLA operation.
C.Configure 'ip route 0.0.0.0 0.0.0.0 10.1.1.2 track 1' to apply the tracking to the default route.
D.Configure 'ip sla reaction-configuration 1 react reachability' to enable reaction on reachability change.
E.Configure 'ip sla logging traps' to enable syslog messages for IP SLA state changes.
AnswersA, B

Correct. This creates and schedules the IP SLA operation, which is the first step.

Why this answer

To track IP SLA reachability, you must first create an IP SLA operation (e.g., type icmp-echo) and schedule it. Then, create a track object that references the IP SLA operation's return code. Finally, apply the track to the static route using the 'track' keyword.

The 'reaction' configuration is optional for basic tracking.

Full explanation →
185
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 source-guard policy Interface Policy Role State Gi0/0/0 SRC_GUARD host ACTIVE Gi0/0/1 SRC_GUARD host ACTIVE Gi0/0/2 (default) host ACTIVE Based on this output, which statement is correct?

A.Only Gi0/0/0 and Gi0/0/1 have source guard enabled.
B.Source guard is enabled on all interfaces, preventing IPv6 address spoofing.
C.Source guard is disabled on Gi0/0/2 because it uses the default policy.
D.Role 'host' means the interface is a router port.
AnswerB

All interfaces show active state with source guard policy.

Why this answer

The output shows that Gi0/0/2 uses the (default) policy, which still applies IPv6 source guard with the role 'host' and state 'ACTIVE'. This means source guard is enabled on all three interfaces, preventing IPv6 address spoofing by filtering traffic based on the source address learned via Neighbor Discovery (ND) or DHCPv6.

Exam trap

The trap here is that candidates assume 'default' policy means disabled or no protection, but in IPv6 source guard, the default policy still enforces source guard filtering with the host role.

How to eliminate wrong answers

Option A is wrong because Gi0/0/2 also has source guard enabled (state ACTIVE), even though it uses the default policy. Option C is wrong because using the default policy does not disable source guard; the default policy still enforces source guard, as indicated by the ACTIVE state. Option D is wrong because the role 'host' indicates the interface is treated as a host port (not a router port), meaning it expects only one source address and drops traffic from other sources.

Full explanation →
186
MCQmedium

A network engineer runs the following command to troubleshoot an IPsec Site-to-Site VPN issue: R1# show crypto isakmp policy Global IKE policy Protection suite of priority 10 encryption algorithm: AES - Advanced Encryption Standard (256 bit keys). hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #5 (1536 bit) lifetime: 86400 seconds, no volume limit Default protection suite encryption algorithm: DES - Data Encryption Standard (56 bit keys). hash algorithm: Secure Hash Standard authentication method: Pre-Shared Key Diffie-Hellman group: #1 (768 bit) lifetime: 86400 seconds, no volume limit What does this output indicate?

A.The IKE policy is correctly configured with strong encryption and DH group.
B.The IKE policy uses DES, which is insecure and should be changed.
C.The IKE policy is missing the authentication method.
D.The IKE policy lifetime is set to 86400 seconds, which is too short.
AnswerA

Priority 10 uses AES-256 and DH group 5, which are strong. However, the default policy is weak and should be removed.

Why this answer

The output shows a global IKE policy with priority 10 using AES-256 encryption, SHA hash, Pre-Shared Key authentication, and Diffie-Hellman group 5 (1536-bit). These parameters represent a strong and secure IKE policy configuration suitable for a production IPsec VPN. The default protection suite is irrelevant unless the peer does not match the higher-priority policy, so the active policy is the one configured with priority 10.

Exam trap

Cisco often tests the distinction between the configured IKE policy and the default protection suite, tricking candidates into thinking the default suite is active or that DES is being used when it is not.

How to eliminate wrong answers

Option B is wrong because the active IKE policy (priority 10) uses AES-256, not DES; DES appears only in the default protection suite, which is not applied unless no matching policy is found. Option C is wrong because the output clearly shows 'authentication method: Pre-Shared Key' for both the priority 10 policy and the default suite, so the authentication method is present. Option D is wrong because an IKE lifetime of 86400 seconds (24 hours) is the default and is considered standard; it is not too short and can be adjusted as needed.

Full explanation →
187
Multi-Selectmedium

Which TWO commands would a network engineer use to verify OSPFv2 neighbor state and adjacency issues on a Cisco IOS router? (Choose TWO.)

Select 2 answers
A.show ip ospf neighbor
B.debug ip ospf adj
C.show ip route ospf
D.show ip ospf interface
E.show ip protocols
AnswersA, B

This command lists all OSPF neighbors and their current state (e.g., FULL, 2WAY, INIT).

Why this answer

The 'show ip ospf neighbor' command displays the state of all OSPF neighbors, while 'debug ip ospf adj' provides real-time adjacency events. 'show ip route ospf' shows routes, not neighbor states; 'show ip ospf interface' shows per-interface details but not neighbor states directly; 'show ip protocols' displays routing process info, not neighbor states.

Full explanation →
188
MCQmedium

A network engineer runs the following command to troubleshoot an IP SLA issue: R1# show ip sla monitor configuration 10 IP SLAs Monitor, Infrastructure Engine-II. Entry number: 10 Owner: Tag: Type of operation to perform: icmp-echo Target address: 192.168.1.1 Type Of Service parameter: 0x0 Request size (ARR data portion): 28 Operation timeout (milliseconds): 5000 Frequency (seconds): 60 Next Scheduled Start Time: Start Time already occurred Group Scheduled : FALSE Life (seconds): Forever Entry Ageout (seconds): never Recurring (Starting Everyday): FALSE Status of entry (SNMP RowStatus): Active Threshold (milliseconds): 5000 Distribution Statistics: Number of history intervals kept: 0 Number of history buckets kept: 15 History Statistics: Number of history Lives kept: 0 What does this output indicate?

A.The IP SLA monitor operation is configured as a UDP jitter probe to 192.168.1.1.
B.The IP SLA monitor operation is configured as an ICMP echo probe with a 60-second frequency and 5-second timeout.
C.The IP SLA monitor operation has a frequency of 5 seconds and a timeout of 60 seconds.
D.The IP SLA monitor operation is in a 'Pending' state.
AnswerB

The configuration matches these parameters.

Why this answer

This is the older 'ip sla monitor' configuration output, identical to 'ip sla configuration'. It shows an ICMP echo probe to 192.168.1.1, active status, 60-second frequency, and 5-second timeout.

Full explanation →
189
MCQhard

A network engineer runs the following command on Router R1: R1# show ip eigrp topology summary IP-EIGRP Topology Table for AS(100)/ID(1.1.1.1) Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply, r - reply Status, s - sia Status P 10.0.0.0/8, 1 successors, FD is 2812416, serno 10 via Summary (2812416/0), Null0 P 10.0.0.0/24, 1 successors, FD is 2172416, serno 5 via 192.168.1.2 (2172416/2812416), GigabitEthernet0/0 P 10.0.1.0/24, 1 successors, FD is 2172416, serno 6 via 192.168.1.2 (2172416/2812416), GigabitEthernet0/0 Based on this output, what is the purpose of the route 10.0.0.0/8 via Null0?

A.It is a default route for unknown destinations.
B.It is a discard route to prevent routing loops.
C.It is a route learned from a neighbor.
D.It is a connected route.
AnswerB

The Null0 interface indicates this is a discard route, commonly used with summarization to avoid loops.

Why this answer

The route 10.0.0.0/8 via Null0 is a summary route created by the 'summary-address' command in EIGRP, used to prevent routing loops by discarding packets that do not match more specific routes.

Full explanation →
190
MCQmedium

A network engineer notices that an SNMPv3 poll from the NMS to router R1 fails with an authentication error. The engineer has configured 'snmp-server group ADMIN v3 priv' and 'snmp-server user admin ADMIN v3 auth sha cisco123 priv aes 128 cisco456'. The NMS is configured with the same credentials. What is the most likely cause of the failure?

A.The SNMP group is missing the 'access' ACL that permits the NMS IP address.
B.The SNMP user password must be at least 8 characters; 'cisco123' is only 8, but the hash algorithm requires a minimum of 12 characters.
C.The NMS is using SNMPv2c, which is incompatible with SNMPv3 configuration.
D.The 'priv' keyword in the group definition should be 'auth' instead to match the user's authentication settings.
AnswerD

Incorrect because 'priv' in the group defines the security level; the user can have 'priv' even if the group is set to 'priv'.

Why this answer

The SNMP group ADMIN is configured with 'v3 priv', which requires both authentication and encryption. The user admin is correctly configured with authentication and privacy. However, the NMS may be sending only authentication without privacy, which leads to an authentication error because the group expects privacy.

The most likely cause is a mismatch between the group's required security level and the NMS's actual request. To resolve this, either the NMS should be configured to use privacy, or the group should be changed to 'v3 auth' to only require authentication. Given the options, changing the group to 'auth' (Option D) would align the group with the NMS's authentication-only behavior, allowing the poll to succeed.

Option A is incorrect because the absence of an access-list in the group configuration defaults to permitting all hosts. Option B is incorrect as there is no minimum length requirement beyond 8 characters. Option C is incorrect because the scenario explicitly involves SNMPv3.

Exam trap

Candidates often overlook the fact that the group security level must match the NMS's actual request. If the NMS only provides authentication credentials but the group requires privacy, the request fails with an authentication error, leading candidates to focus on password or ACL issues.

How to eliminate wrong answers

Option B is wrong because SNMPv3 SHA authentication passwords have no minimum length requirement of 12 characters; 'cisco123' is a valid 8-character password. Option C is wrong because the NMS is configured with the same SNMPv3 credentials, so it is using SNMPv3, not SNMPv2c; the error message specifically indicates an authentication failure, not a version mismatch. Option D is wrong because the 'priv' keyword in the group definition is correct for a user that requires both authentication and encryption; changing it to 'auth' would remove privacy (encryption) and still not fix the ACL issue.

Full explanation →
191
MCQmedium

In a 6to4 tunnel, what is the default IPv6 prefix assigned to the tunnel interface?

A.2002::/16
B.2002:IPv4-address::/48
C.2001::/32
D.3ffe::/16
AnswerB

The tunnel interface gets a /48 prefix based on its source IPv4 address.

Why this answer

In a 6to4 tunnel, the default IPv6 prefix assigned to the tunnel interface is 2002:IPv4-address::/48, where the IPv4 address of the tunnel source is embedded in the prefix. This is defined in RFC 3056, which specifies that the 6to4 prefix is 2002::/16, and the next 32 bits are the tunnel source's IPv4 address, resulting in a /48 prefix for the 6to4 site.

Exam trap

Cisco often tests the distinction between the 6to4 prefix range (2002::/16) and the actual prefix assigned to the tunnel interface (2002:IPv4-address::/48), leading candidates to mistakenly select the broader /16 prefix instead of the correct /48 derived from the IPv4 address.

How to eliminate wrong answers

Option A is wrong because 2002::/16 is the overall 6to4 prefix range, not the specific prefix assigned to the tunnel interface; the tunnel interface uses a /48 derived from the IPv4 address. Option C is wrong because 2001::/32 is the prefix for 6rd (IPv6 Rapid Deployment) or some tunnel broker deployments, not for 6to4 tunnels. Option D is wrong because 3ffe::/16 was part of the 6bone testing address space, which is deprecated and not used for 6to4 tunnels.

Full explanation →
192
MCQmedium

In a VRF-Lite setup using RIP, what is the default update timer value?

A.30 seconds
B.60 seconds
C.90 seconds
D.180 seconds
AnswerA

RIP uses a default update timer of 30 seconds.

Why this answer

RIP sends routing updates every 30 seconds by default, as defined in RFC 1058.

Full explanation →
193
Multi-Selecthard

Which TWO commands can be used to verify the operational state and statistics of an IP SLA operation? (Choose TWO.)

Select 2 answers
A.show ip sla statistics
B.show ip sla summary
C.show ip sla configuration
D.show track
E.debug ip sla trace
AnswersA, B

Correct. This command displays detailed statistics such as RTT, packet loss, and jitter for each IP SLA operation.

Why this answer

The 'show ip sla statistics' command displays detailed statistics for all IP SLA operations, including RTT, packet loss, and jitter. The 'show ip sla configuration' command shows the configuration parameters, not real-time state. 'show track' shows the state of track objects, not the IP SLA operation directly. 'show ip sla summary' provides a one-line summary of each operation's state. 'debug ip sla trace' is a debug command, not a verification show command.

Full explanation →
194
Multi-Selectmedium

Which TWO commands can be used to verify IP SLA operations on a Cisco IOS device? (Choose TWO.)

Select 2 answers
A.show ip sla statistics
B.show ip sla reaction-configuration
C.show ip sla configuration
D.show ip sla monitor
E.show ip sla summary
AnswersA, B

Displays the latest statistics for each configured IP SLA operation.

Why this answer

The 'show ip sla statistics' command displays the latest statistics for each IP SLA operation, and 'show ip sla reaction-configuration' shows the threshold and reaction settings. 'show ip sla configuration' shows the configuration but not live statistics. 'show ip sla monitor' is a legacy command not used in modern IOS. 'show ip sla summary' is not a valid command.

Full explanation →
195
MCQmedium

A network engineer runs the following command to verify NetFlow data export format: R1# show flow exporter EXPORTER-1 Flow Exporter: EXPORTER-1 Transport Configuration: Destination IP address: 192.168.1.100 Source IP address: 10.0.0.1 Transport Protocol: UDP Destination Port: 2055 Source Port: 51234 DSCP: 0x00 TTL: 255 Output Features: Used Export Protocol: NetFlow Version 9 Template Data Export Timeout: 1800 seconds Option Data Export Timeout: 1800 seconds Option Data Configured: application-table sub-application-table application-attributes What does this output indicate?

A.The exporter uses TCP to ensure reliable delivery of flow records.
B.The exporter is configured to send NetFlow version 9 data with application option data, indicating NBAR integration.
C.The exporter is not sending any option data.
D.The exporter uses a destination port of 514.
AnswerB

The exporter uses NetFlow v9 and includes option data for application-table, sub-application-table, and application-attributes, which are used with NBAR.

Why this answer

The output shows the configuration of a Flexible NetFlow exporter. It uses UDP to send NetFlow version 9 data to 192.168.1.100 on port 2055. It also exports option data like application tables and attributes, which are used for NBAR-based application recognition.

Full explanation →
196
MCQmedium

A network engineer runs the following command to troubleshoot a Device Access Control issue: R1# show crypto isakmp sa detail Codes: C - IKE configuration mode, D - Dead Peer Detection I - IKE Initiatior, R - IKE Responder C-id Local Remote I-VRF Status Encr Hash Auth DH Lifetime Cap. 1001 10.1.1.1 10.1.1.2 ACTIVE aes sha md5 2 86400 D What does this output indicate?

A.An IKE Phase 1 SA is established with the remote peer using AES encryption and SHA hash.
B.The IKE Phase 1 SA is in a failed state because the authentication method is MD5.
C.The IKE Phase 2 SA is established with the remote peer.
D.The router is the initiator of the IKE Phase 1 SA.
AnswerA

The SA is ACTIVE with the specified parameters: aes encryption, sha hash, md5 auth, DH group 2.

Why this answer

The output from 'show crypto isakmp sa detail' displays an IKE Phase 1 (ISAKMP) security association with status 'ACTIVE', indicating successful Phase 1 negotiation. The 'Encr' column shows 'aes', 'Hash' shows 'sha', and 'Auth' shows 'md5', confirming AES encryption and SHA hash are used. This matches option A, which correctly identifies an established IKE Phase 1 SA with those parameters.

Exam trap

Cisco often tests the distinction between IKE Phase 1 and Phase 2 SAs, and candidates may confuse 'show crypto isakmp sa' (Phase 1) with 'show crypto ipsec sa' (Phase 2), leading them to incorrectly select option C.

How to eliminate wrong answers

Option B is wrong because the status is 'ACTIVE', not failed; MD5 is used for authentication (Auth column), not as a hash algorithm, and while MD5 is weak, it does not cause a failure here. Option C is wrong because this command shows IKE Phase 1 (ISAKMP) SAs, not Phase 2 (IPsec) SAs; Phase 2 is verified with 'show crypto ipsec sa'. Option D is wrong because the 'I-VRF' column is empty and the 'Cap.' column shows 'D' (Dead Peer Detection), but there is no 'I' (Initiator) or 'R' (Responder) flag in the output; the 'C-id' and other fields do not indicate the initiator role.

Full explanation →
197
Multi-Selectmedium

Which TWO statements about BGP route reflectors are true when troubleshooting route propagation issues? (Choose TWO.)

Select 2 answers
A.A route reflector forwards routes received from a non-client peer to all client and non-client peers.
B.A route reflector appends its own AS number to the AS_PATH when reflecting routes.
C.The cluster ID is used to prevent routing loops within a route reflector cluster.
D.Clients in a route reflector cluster must be fully meshed with each other.
E.A route reflector changes the next-hop attribute to its own address when reflecting routes.
AnswersA, C

This is a standard behavior of route reflectors to reduce IBGP peering.

Why this answer

Route reflectors pass routes from non-client peers to all other peers (including other clients and non-clients) without requiring full mesh, but they do not modify the AS_PATH. The cluster ID is used to prevent loops within a cluster. Option B is incorrect because route reflectors do not prepend the AS_PATH.

Option D is incorrect because clients must peer only with the route reflector, not with each other. Option E is incorrect because the next-hop is not changed by default.

Full explanation →
198
MCQmedium

A network engineer is troubleshooting a router that is not sending SNMP traps to the NMS server at 10.1.1.100. The SNMP configuration includes 'snmp-server enable traps' and 'snmp-server host 10.1.1.100 version 2c public'. The engineer can ping the NMS server from the router, and 'show snmp' indicates SNMP is enabled. What is the most likely cause of the missing traps?

A.The NMS server is not listening on UDP port 162.
B.The 'snmp-server trap-source' command is missing, causing traps to use an incorrect source IP.
C.The SNMP community string 'public' is not configured on the router.
D.The router's ACL is blocking outbound UDP traffic to port 162.
AnswerB

Without 'snmp-server trap-source', the router uses the outgoing interface IP, which may not match the NMS's expected source or may be unreachable.

Why this answer

The most likely cause is that the 'snmp-server trap-source' command is missing. Without this command, the router uses the IP address of the outbound interface (e.g., a loopback or WAN interface) as the source for SNMP traps. If the NMS server expects traps from a specific source IP (e.g., the router's management IP), it may drop or ignore them, even though the router can ping the NMS.

The 'show snmp' output confirms SNMP is enabled, and the ping test rules out basic reachability, pointing to a source IP mismatch as the root cause.

Exam trap

Cisco often tests the 'snmp-server trap-source' command as a subtle but critical configuration requirement, leading candidates to overlook it and instead blame community strings or ACLs when basic connectivity (ping) is successful.

How to eliminate wrong answers

Option A is wrong because the NMS server listening on UDP port 162 is a prerequisite for receiving traps; if it were not listening, the router would likely see 'no response' or timeouts, but the engineer can ping the NMS, and SNMP traps are sent as UDP datagrams that can be lost without a listener, but the question states the router is not sending traps, not that they are sent and lost. Option C is wrong because the community string 'public' is specified in the 'snmp-server host' command, and the router does not require a separate 'snmp-server community' command for trap generation; the community string in the host command defines the string used in the trap packet. Option D is wrong because the engineer can ping the NMS server, which uses ICMP (not UDP 162), but an ACL blocking outbound UDP to port 162 would not affect ICMP echo requests; however, the question states the router is not sending traps, and an ACL would typically cause the trap to be dropped silently, but the more specific and common cause in Cisco troubleshooting is the missing trap-source command, especially when multiple interfaces exist.

Full explanation →
199
MCQmedium

A network engineer runs the following command on Router R8: R8# show logging | include %LDP-5-NBRCHG *Mar 1 00:01:10.123: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP *Mar 1 00:02:20.456: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN *Mar 1 00:03:30.789: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is UP *Mar 1 00:04:40.012: %LDP-5-NBRCHG: LDP Neighbor 10.0.0.2:0 (1) is DOWN Based on this output, what is the most likely problem?

A.The LDP session is flapping due to an unstable IGP route to 10.0.0.2.
B.The MPLS label space is exhausted.
C.The router has a mismatched LDP router ID.
D.The LDP hello interval is set too high, causing slow detection.
AnswerA

LDP relies on IGP to establish and maintain neighbors; if the IGP route is flapping, LDP will also flap.

Why this answer

The output shows LDP neighbor 10.0.0.2 flapping between UP and DOWN. This indicates instability in the LDP session, often due to a flapping IGP route (since LDP depends on IGP reachability), or a misconfiguration of LDP parameters such as hello interval or hold time.

Full explanation →
200
Drag & Dropmedium

Drag and drop the steps to create and register an EEM applet for syslog events into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

The correct order begins with entering global configuration mode, then defining the EEM applet and its syslog trigger, followed by configuring the action to execute, and finally exiting configuration mode to register the applet.

Full explanation →
201
MCQmedium

A network engineer runs the following command on Router R1: R1# show ip dhcp conflict IP address Detection method Detection time VRF 192.168.1.20 Ping Mar 01 2020 01:00 AM 192.168.1.21 Gratuitous ARP Mar 01 2020 01:05 AM Based on this output, what is the problem?

A.The DHCP server is working normally; conflicts are automatically resolved.
B.The DHCP server has detected IP address conflicts, meaning another device on the network is using the same IP addresses.
C.The DHCP server is not responding to client requests.
D.The DHCP pool is misconfigured with overlapping subnets.
AnswerB

Conflicts indicate duplicate IP usage on the network.

Why this answer

The `show ip dhcp conflict` command displays IP addresses that the DHCP server has detected as already in use on the network. The detection methods (Ping and Gratuitous ARP) confirm that another device is responding to these addresses, indicating a conflict. This output directly shows that the DHCP server is functioning but has identified conflicts, meaning another host is using the same IP addresses.

Exam trap

Cisco often tests the distinction between a DHCP server that is working but detecting conflicts versus a server that is failing to respond or misconfigured, leading candidates to incorrectly assume the server is broken when it is actually performing its conflict detection duties correctly.

How to eliminate wrong answers

Option A is wrong because conflicts are not automatically resolved; the DHCP server logs them and will not lease those addresses until the conflict is cleared manually or via timeout. Option C is wrong because the output shows the DHCP server is actively detecting conflicts, which requires it to be responding to client requests and performing conflict detection. Option D is wrong because overlapping subnets would cause pool exhaustion or misallocation, but the output specifically shows address conflicts detected via Ping and ARP, not a pool configuration issue.

Full explanation →
202
MCQeasy

What is the default port number used by syslog servers to receive UDP syslog messages?

A.UDP 162
B.UDP 514
C.TCP 514
D.UDP 161
AnswerB

UDP port 514 is the well-known port for syslog.

Why this answer

RFC 5424 specifies UDP port 514 as the default for syslog messages.

Full explanation →
203
Drag & Dropmedium

Drag and drop the steps to negotiate an IKEv2 IPsec site-to-site tunnel into the correct order, from first to last.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4
5Step 5

Why this order

IKEv2 negotiation begins with Phase 1 (IKE_SA_INIT) to establish a secure channel, followed by IKE_AUTH to authenticate and exchange identities. Phase 2 (CREATE_CHILD_SA) then negotiates the IPsec SA, and the final step installs the IPsec security associations into the data plane.

Full explanation →
204
MCQhard

A network engineer redistributes OSPF routes into EIGRP on Router R1. After redistribution, Router R3, which is an EIGRP neighbor of R1, starts experiencing routing loops for the 192.168.1.0/24 network. R1 configuration: router eigrp 100, redistribute ospf 1 metric 10000 100 255 1 1500, route-map RM-OSPF-to-EIGRP. The route-map sets tag 100. R3 shows: 'show ip route 192.168.1.0' points to R1, but traceroute shows packets looping between R1 and R3. What is the root cause?

A.The redistribution metric is too low, causing the route to be preferred over the OSPF path, but the loop is due to missing route tagging and filtering on redistribution.
B.The EIGRP metric values are incorrect; the delay value of 100 is too high, causing the route to be considered unreachable.
C.The route-map is applied in the wrong direction; it should be applied to the redistribute command under OSPF instead of EIGRP.
D.R3 has a static route for 192.168.1.0/24 pointing to R1, overriding the dynamic route.
AnswerA

The route-map sets a tag, but without a corresponding filter on the OSPF side (e.g., deny routes with tag 100), the route can be redistributed back into OSPF, creating a loop.

Why this answer

The root cause is that the redistributed OSPF routes into EIGRP lack proper route tagging and filtering, causing R3 to re-advertise the 192.168.1.0/24 route back to R1, creating a routing loop. The route-map sets a tag of 100, but without an inbound filter on R1 (e.g., a distribute-list or route-map denying tagged routes), R1 will accept the route from R3, leading to a loop. Option A correctly identifies that the metric is sufficient for the route to be preferred, but the missing loop-prevention mechanism is the core issue.

Exam trap

Cisco often tests the misconception that a low metric or incorrect metric values cause routing loops, when the real issue is the absence of loop-prevention mechanisms like route tagging and filtering in a multi-protocol redistribution scenario.

How to eliminate wrong answers

Option B is wrong because an EIGRP delay of 100 microseconds is not too high; it is a standard value that does not make the route unreachable—unreachability would require a delay of 16,777,215 microseconds (max). Option C is wrong because the route-map is correctly applied under the EIGRP process to filter routes being redistributed from OSPF; applying it under OSPF would be incorrect as redistribution is configured under EIGRP. Option D is wrong because the scenario states R3's routing table points to R1 via EIGRP, not a static route, and a static route would not cause the specific loop behavior described (packets bouncing between R1 and R3).

Full explanation →
205
MCQmedium

A network engineer runs the following command on Router R1: R1# show event manager policy registered No. Type Time Created Name 1 applet 00:01:23 UTC Mar 1 2025 BGP_Neighbor_Down R1# show bgp summary BGP router identifier 10.0.0.1, local AS number 65001 BGP table version is 1, main routing table version 1 Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 192.168.1.2 4 65002 5 5 1 0 0 00:02:00 Established Based on this output, which statement is correct?

A.The BGP neighbor is down.
B.The EEM policy has been triggered.
C.The BGP neighbor is up and the EEM policy has not been triggered.
D.The EEM policy is disabled.
AnswerC

The Established state confirms the neighbor is up, so the down event has not occurred.

Why this answer

The EEM policy BGP_Neighbor_Down is registered, but the BGP neighbor is in Established state. The correct answer is that the BGP neighbor is up and the EEM policy has not been triggered.

Full explanation →
206
MCQhard

An engineer configures an RSPAN session on a Cisco switch to monitor traffic from VLAN 30 and send it to a remote switch. The engineer creates RSPAN VLAN 200 on both switches and configures the trunk to allow VLAN 200. On the remote switch, the engineer configures the destination port as GigabitEthernet0/4 in VLAN 200. The engineer notices that the destination port is forwarding traffic, but the traffic is not from the source VLAN 30; instead, it is broadcast traffic from other VLANs. What is the most likely cause?

A.The RSPAN VLAN is also being used for other VLAN traffic due to misconfiguration.
B.The source VLAN is not configured correctly on the source switch.
C.The destination port is in the wrong VLAN.
D.The trunk is not pruning VLAN 200 correctly.
AnswerA

Correct because the RSPAN VLAN should be a dedicated VLAN; if it is also used as a native VLAN or for other traffic, it will carry unwanted broadcasts.

Why this answer

RSPAN VLANs should be used exclusively for RSPAN traffic and should not have any other VLANs mapped to them. If the RSPAN VLAN is also used for other purposes, it may carry unintended traffic.

Full explanation →
207
Multi-Selecthard

Which TWO statements about the 'ip access-list resequence' command are true? (Choose TWO.)

Select 2 answers
A.The 'ip access-list resequence' command can be applied to both numbered and named ACLs.
B.The default starting sequence number for the resequence command is 10, and the default increment is 10.
C.The resequence command changes the order in which ACL entries are evaluated.
D.The resequence command is useful when you need to insert a new ACE between two existing entries with consecutive sequence numbers.
E.The resequence command can only be used on extended named ACLs, not standard named ACLs.
AnswersB, D

Correct. By default, the command renumbers starting at 10 with an increment of 10, unless custom values are specified.

Why this answer

The default starting sequence number for the 'ip access-list resequence' command is 10, and the default increment is also 10. This allows you to renumber the Access Control Entries (ACEs) within an ACL so that you can later insert new entries between existing ones without having to remove and re-add the entire list.

Exam trap

Cisco often tests the misconception that resequencing changes the evaluation order of ACL entries, when in fact it only renumbers the entries without altering their sequence of evaluation.

Full explanation →
208
MCQmedium

Consider this partial configuration: ``` ip vrf CUSTOMER_B rd 65000:1 route-target export 65000:1 route-target import 65000:1 ``` What statement is true about this VRF configuration?

A.The VRF will not function because route-targets are mandatory for VRF-Lite.
B.The VRF is correctly configured for VRF-Lite with a unique RD and optional route-targets.
C.The RD must match the route-target value exactly.
D.The VRF will only work if 'vrf forwarding' is applied to an interface.
AnswerB

This is correct. The RD is required, and route-targets are optional but often configured for consistency.

Why this answer

In VRF-Lite, route-targets are not strictly required because there is no MP-BGP exchange. However, they are used for interoperability and to define import/export policies if needed. The RD is mandatory to create the VRF.

Full explanation →
209
Multi-Selecthard

An engineer is troubleshooting a BGP route advertisement issue. Which TWO commands can be used to verify whether a prefix is being advertised to a specific BGP neighbor? (Choose TWO.)

Select 2 answers
A.show ip bgp neighbors <neighbor> routes
B.show ip bgp <prefix>
C.show ip bgp neighbors <neighbor> advertised-routes
D.debug ip bgp updates
E.show ip bgp summary
AnswersB, C

Correct. This command displays the BGP entry for a prefix, including the neighbor(s) to which the route is advertised.

Why this answer

To verify BGP advertisement to a neighbor, 'show ip bgp neighbors <neighbor> advertised-routes' shows all routes advertised to that neighbor. 'show ip bgp <prefix>' includes an entry for each neighbor the route is advertised to. 'show ip bgp neighbors <neighbor> routes' shows routes received from the neighbor, not advertised. 'debug ip bgp updates' is a debug command, not a verification command. 'show ip bgp summary' shows neighbor states and counts, not specific prefix advertisement.

Full explanation →
210
MCQhard

A network engineer is troubleshooting an OSPFv3 issue where a router R1 is not learning routes from a neighbor R2. The adjacency is FULL, but 'show ipv6 route ospf' on R1 shows only a default route. R2 is an ASBR redistributing connected routes into OSPFv3. 'show ipv6 ospf database external' on R1 shows the external routes, but they are not installed in the routing table. What is the most likely cause?

A.The router R1 has a distribute-list in the OSPFv3 process that filters out the external routes.
B.The external routes have a metric of 16777214, which is considered infinite.
C.The router R1 does not have IPv6 unicast routing enabled.
D.The external routes are type 5 LSAs but the router is in a totally stubby area.
AnswerA

A distribute-list can filter routes from being installed in the routing table even if they are in the LSDB.

Why this answer

In OSPFv3, external routes are not installed if the router has a route to the forwarding address that is not reachable. However, the more common cause is that the OSPFv3 process on R1 has 'no ipv6 unicast-routing' or the router is missing a default route to reach the external destinations. Another possibility is that the external routes have a metric that is too high or the route is suppressed by a filter.

The most likely cause is that the router has a route map or distribute list that is filtering the external routes from being installed.

Full explanation →
211
MCQeasy

A network engineer runs the following command on Router R1: R1# show ip sla statistics IPSLAs Latest Statistics: Round Trip Time (RTT) for Index 1 Latest RTT: 10 ms Latest RTT (milliseconds): 10 Number of successes: 100 Number of failures: 0 Operation time to live: 3000 Operation frequency: 60 seconds Next operation start time: 00:00:45 Based on this output, what is the status of the IP SLA operation?

A.The IP SLA operation has failed 100 times.
B.The IP SLA operation is successful and has a low RTT.
C.The IP SLA operation is not configured correctly.
D.The IP SLA operation is about to expire.
AnswerB

100 successes and 10 ms RTT indicate good performance.

Why this answer

The output shows 100 successes and 0 failures, with a latest RTT of 10 ms, indicating the IP SLA operation is functioning correctly and with low latency. The 'Number of successes: 100' confirms the operation has been consistently successful, and the low RTT value reflects good network performance.

Exam trap

Cisco often tests the misinterpretation of 'Number of successes' versus 'Number of failures', leading candidates to confuse the count of successes with failures, especially when the numbers are large.

How to eliminate wrong answers

Option A is wrong because the output clearly states 'Number of failures: 0', not 100; the 100 refers to successes, not failures. Option C is wrong because the operation is configured correctly, as evidenced by the successful probes, valid frequency (60 seconds), and time-to-live (3000 seconds). Option D is wrong because the 'Operation time to live: 3000' indicates the operation will remain active for 3000 seconds (50 minutes) from its start, and the 'Next operation start time: 00:00:45' shows it is scheduled to run again in 45 seconds, not about to expire.

Full explanation →
212
MCQhard

A network engineer runs the following command to troubleshoot SNMPv3 group configuration: R1# show snmp group group name: admin-group security model: v3 auth priv read view: v1default write view: v1default notify view: v1default Group name: monitor-group security model: v3 auth no priv read view: v1default write view: none notify view: v1default What does this output indicate?

A.The 'admin-group' requires authentication and encryption, while 'monitor-group' requires only authentication.
B.Both groups require authentication and encryption.
C.The 'monitor-group' has read-write access.
D.The groups use SNMPv2c security model.
AnswerA

admin-group uses 'auth priv' (auth + encryption), monitor-group uses 'auth no priv' (auth only).

Why this answer

The output shows that 'admin-group' uses security model 'v3 auth priv', which requires both authentication and encryption (privacy). 'monitor-group' uses 'v3 auth no priv', which requires authentication but no encryption. This matches option A exactly.

Exam trap

Cisco often tests the distinction between 'auth priv' and 'auth no priv' by presenting output where candidates mistakenly assume both groups require encryption, or confuse 'write view: none' with having write access.

How to eliminate wrong answers

Option B is wrong because 'monitor-group' uses 'auth no priv', not 'auth priv', so it does not require encryption. Option C is wrong because 'monitor-group' has 'write view: none', meaning it has no write access, only read access. Option D is wrong because both groups explicitly use 'v3' security model, which is SNMPv3, not SNMPv2c.

Full explanation →
213
MCQhard

A DMVPN Phase 3 network uses BGP for routing between hubs and spokes. R1 (hub) and R2 (spoke) have an eBGP peering. R2 advertises a prefix 192.168.1.0/24 to R1. R3 (another spoke) receives this prefix via R1 but with a higher local preference than expected, causing R3 to prefer the path through R1 even though a direct spoke-to-spoke tunnel exists. What is the root cause?

A.R1 has a route-map that sets local preference to 200 for prefixes received from R2, causing R3 to prefer the path through R1 over the direct path.
B.R3 has a static route pointing to R1 for 192.168.1.0/24, overriding BGP.
C.NHRP redirect is disabled on R1, preventing spoke-to-spoke tunnel establishment.
D.R2 is advertising the prefix with a MED of 0, causing R3 to prefer the path through R1.
AnswerA

Correct. BGP local preference is propagated to iBGP peers. If R1 sets a high local preference on routes from R2, R3 will prefer the path via R1, even if a direct spoke-to-spoke tunnel is available.

Why this answer

BGP local preference is manipulated on the hub (R1) using route-maps or policy, causing the prefix to have a higher local preference when advertised to other spokes. This overrides the normal BGP path selection and forces traffic through the hub, even if a direct spoke-to-spoke tunnel is available.

Full explanation →
214
MCQhard

A network engineer runs the following command to troubleshoot an ERSPAN issue: R1# show monitor session 6 detail Session 6 --------- Type : ERSPAN Source Session Source VLANs : Both : 10-20 Destination IP : 10.1.1.3 ERSPAN ID : 200 What does this output indicate?

A.The session is correctly configured to monitor VLANs 10 through 20.
B.The session is misconfigured because ERSPAN cannot use VLANs as source.
C.The session is misconfigured because the ERSPAN ID must be less than 100.
D.The session is misconfigured because the destination IP must be on the same subnet.
AnswerA

ERSPAN can use VLANs as the source for monitoring.

Why this answer

The output shows an ERSPAN source session with source VLANs 10-20, destination IP 10.1.1.3, and ERSPAN ID 200. This is a valid ERSPAN source session using VLANs as the source.

Full explanation →
215
MCQhard

A network engineer is troubleshooting an MPLS L3VPN where CE1 can ping the PE1 interface but cannot ping CE2. On PE1, show ip route vrf CUSTOMER shows the route to CE2's subnet, but show bgp vpnv4 unicast all neighbors 10.0.0.2 advertised-routes does not show the route. The BGP session between PE1 and PE2 is established. What is the most likely cause?

A.The VRF export route-target does not match the import route-target on the remote PE.
B.A route-map applied to the VRF export is filtering the route.
C.The BGP session is not using the correct update-source.
D.The next-hop-self command is missing under the VRF address-family.
AnswerB

Correct because a route-map on VRF export can filter routes before they are advertised to BGP, preventing the route from being sent to the remote PE.

Why this answer

The route is present in the VRF but not advertised to the remote PE, indicating a BGP policy issue. Since the BGP session is up, the most likely cause is that the route is not being redistributed into BGP or is being filtered by a route-map or prefix-list on the VRF export.

Full explanation →
216
MCQeasy

A network engineer runs the following command on Router PE5: PE5# show ip ospf neighbor Neighbor ID Pri State Dead Time Address Interface 10.0.0.7 1 FULL/DR 00:00:32 10.1.1.7 GigabitEthernet0/0 10.0.0.8 1 FULL/BDR 00:00:35 10.2.2.8 GigabitEthernet0/1 Based on this output, which statement is correct?

A.Both OSPF adjacencies are fully established.
B.One neighbor is in the EXSTART state.
C.The router is not the DR for any segment.
D.There is a mismatch in OSPF area IDs.
AnswerA

The state is FULL for both neighbors, indicating full adjacency.

Why this answer

The show ip ospf neighbor output displays two OSPF neighbors in FULL state, one as DR and one as BDR. This indicates that OSPF adjacencies are fully established and functioning correctly.

Full explanation →
217
Multi-Selecthard

Which TWO statements about IP SLA responder configuration are true? (Choose TWO.)

Select 2 answers
A.The 'ip sla responder' command must be configured on the destination device for UDP jitter probes to obtain accurate round-trip time.
B.The responder can be configured to listen on a specific UDP port using the 'ip sla responder udp-echo' command.
C.The responder is automatically enabled on all Cisco routers running IOS 15.0 or later.
D.The ICMP echo probe type requires the responder to be configured on the destination for accurate results.
E.The responder can provide hardware-based timestamping to improve accuracy when the 'timestamp' option is configured.
AnswersA, B

Correct. UDP jitter probes require the responder to timestamp the packets for accurate delay and jitter calculations.

Why this answer

The IP SLA responder is a component that listens for probe requests and sends replies. It is required for certain probe types like UDP jitter and TCP connect to ensure accurate measurements. The responder must be enabled on the destination device with the 'ip sla responder' global command.

It does not require a specific port for ICMP echo, and it does not automatically adjust timestamps without the 'timestamp' option.

Full explanation →
218
MCQhard

A dual-stack network using IPv6 over IPv4 GRE tunnels with OSPFv3 is experiencing routing loops. Router R1 has the following relevant configuration: interface Tunnel0 ipv6 address 2001:DB8:1::1/64 tunnel source 192.0.2.1 tunnel destination 198.51.100.1 ipv6 ospf network point-to-point ipv6 ospf 1 area 0. Router R2 shows: R2# show ipv6 ospf neighbor Neighbor ID Pri State Dead Time Interface ID Interface 192.0.2.2 1 FULL/ - 00:00:33 7 Tunnel0. R2# show ipv6 route 2001:DB8:3::/64 O 2001:DB8:3::/64 [110/2] via 2001:DB8:1::1, Tunnel0. What is the root cause?

A.The OSPF network type on Tunnel0 should be broadcast to match the underlying GRE tunnel.
B.The tunnel destination on R1 is incorrect, causing OSPF adjacencies to form with the wrong router.
C.R1 has a higher metric for the same prefix via another interface, causing a routing loop due to OSPF's SPF algorithm.
D.IPv6 unicast-routing is not enabled on R1.
AnswerC

If R1 learns the prefix via a different path with a higher metric, it may still prefer the tunnel route, but if that tunnel route points back to R2, a loop occurs.

Why this answer

The routing loop is caused by R1 having a higher metric for the prefix 2001:DB8:3::/64 via another interface, which OSPF's SPF algorithm still installs in the routing table. Since R2's best path to that prefix points to R1 via Tunnel0 (metric 2), and R1's best path points back to R2 via a different interface with a higher metric, traffic bounces between them. This is a classic OSPF metric asymmetry issue in a dual-stack GRE tunnel environment.

Exam trap

Cisco often tests the misconception that routing loops in OSPF are caused by network type mismatches or tunnel misconfigurations, when the real issue is metric asymmetry between routers leading to recursive routing.

How to eliminate wrong answers

Option A is wrong because OSPFv3 over a point-to-point GRE tunnel should use the point-to-point network type to avoid DR/BDR elections and simplify adjacency formation; changing to broadcast would add unnecessary overhead and not fix a routing loop. Option B is wrong because the tunnel destination on R1 (198.51.100.1) is correct for reaching R2, and the OSPF neighbor output confirms a full adjacency with Neighbor ID 192.0.2.2, indicating the tunnel is properly formed. Option D is wrong because if IPv6 unicast-routing were not enabled on R1, OSPFv3 would not form adjacencies or install routes, but the show output shows an active OSPF neighbor and a route via Tunnel0, proving it is enabled.

Full explanation →
219
MCQhard

An engineer configures BFD for EIGRP in named mode. The BFD session is up, but the EIGRP neighbor relationship is not forming. The engineer checks that the K values match and that the interfaces are up. What is the most likely explanation?

A.The 'no neighbor' command is configured under the af-interface, disabling EIGRP on that interface.
B.The 'bfd' command is configured under the af-interface, but the 'bfd all-interfaces' command is missing under the EIGRP process.
C.The EIGRP router ID is the same on both routers, causing a conflict.
D.The interface is configured with 'ip bandwidth-percent eigrp' set to 0, preventing EIGRP from using the interface.
AnswerA

Correct. In named mode, the 'no neighbor' command under the af-interface prevents EIGRP from forming adjacencies on that interface, even if BFD is up.

Why this answer

In EIGRP named mode, the 'af-interface' configuration can have different settings than classic mode. Specifically, the 'no neighbor' command under the af-interface can disable EIGRP on that interface, preventing adjacency formation. BFD is configured under the af-interface as well, but if the interface is disabled for EIGRP, BFD will not help.

Full explanation →
220
MCQhard

An engineer configures BFD on an OSPF link that is part of a virtual link. The BFD session between the two endpoints of the virtual link is up, but OSPF adjacency over the virtual link is not forming. What is the most likely explanation?

A.BFD cannot be used with OSPF virtual links; BFD only works on physical interfaces.
B.The virtual link is configured with a different hello interval than the BFD interval, causing a mismatch.
C.The 'bfd all-interfaces' command is not configured under the OSPF process, so OSPF ignores BFD for virtual links.
D.The virtual link is using a different authentication type than the BFD session.
AnswerA

Correct. OSPF virtual links are not supported with BFD. The BFD session on the underlying physical interface does not affect the virtual link adjacency.

Why this answer

BFD does not support virtual links in OSPF. BFD can only be configured on physical interfaces or subinterfaces, not on virtual links. Therefore, even if BFD is up on the underlying physical link, it will not help detect failures of the virtual link.

The virtual link adjacency may fail due to other issues, such as mismatched area IDs or authentication.

Full explanation →
221
MCQhard

An engineer configures mutual redistribution between EIGRP and OSPF on a router. EIGRP routes are redistributed into OSPF with a route-map that sets metric-type type-1, and OSPF routes are redistributed into EIGRP with default metric 10000 100 255 1 1500. Unexpectedly, the router starts flapping routes between the two protocols, causing instability. Which is the most likely explanation?

A.The redistribution is not using route tags, so routes are being re-redistributed back and forth, causing route flapping.
B.The OSPF metric-type type-1 is incompatible with EIGRP, causing the route to be rejected.
C.The EIGRP default metric is missing the reliability and load values, so redistribution fails.
D.The router must have `redistribute connected` under both protocols to avoid flapping.
AnswerA

Without tags, there is no loop prevention; routes can be redistributed multiple times.

Why this answer

Without route tagging, mutual redistribution can cause a routing loop where a route redistributed from EIGRP into OSPF is then redistributed back into EIGRP with a different metric, creating a feedback loop. The router sees the same prefix from both protocols and may prefer one over the other, causing continuous updates. The solution is to use route tags to prevent re-redistribution.

Full explanation →
222
MCQmedium

A network engineer runs the following command on Router R1: R1# show ipv6 bgp summary BGP router identifier 192.168.1.1, local AS number 65001 BGP table version is 10, main routing table version 10 5 network entries using 720 bytes of memory 5 path entries using 400 bytes of memory 3/2 BGP path/bestpath attribute entries using 456 bytes of memory 1 BGP AS-PATH entries using 24 bytes of memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP filter-list cache entries using 0 bytes of memory BGP using 1600 total bytes of memory BGP activity 10/5 prefixes, 10/5 paths, scan interval 60 secs Neighbor V AS MsgRcvd MsgSent TblVer InQ OutQ Up/Down State/PfxRcd 2001:DB8::2 4 65002 100 99 10 0 0 00:45:12 3 Based on this output, which statement is correct?

A.BGP is not configured for IPv6.
B.The BGP session is down.
C.BGP is peering over IPv6 and 3 prefixes are learned from the neighbor.
D.The router is in AS 65002.
AnswerC

The neighbor is IPv6 and PfxRcd shows 3.

Why this answer

The output shows that the neighbor 2001:DB8::2 (IPv6 address) is in state '3' under 'State/PfxRcd', which indicates the BGP session is established and 3 IPv6 prefixes have been received from that neighbor. The 'Up/Down' time of 00:45:12 confirms the session is active, and the 'MsgRcvd/MsgSent' counters show bidirectional communication. Therefore, BGP is peering over IPv6 and has learned 3 prefixes from the neighbor, making option C correct.

Exam trap

Cisco often tests the interpretation of the 'State/PfxRcd' column in 'show bgp ipv6 unicast summary' (or 'show ipv6 bgp summary'), where a numeric value indicates an established session and received prefixes, while a state name indicates a session problem, leading candidates to mistakenly think the session is down when they see a number instead of a state.

How to eliminate wrong answers

Option A is wrong because the command 'show ipv6 bgp summary' explicitly displays IPv6 BGP information, and the neighbor is an IPv6 address (2001:DB8::2), proving BGP is configured for IPv6. Option B is wrong because the 'State/PfxRcd' column shows '3' (not an idle/active/connect state), and the 'Up/Down' timer is 00:45:12, indicating the session is up and exchanging prefixes. Option D is wrong because the output clearly states 'local AS number 65001' in the BGP router identifier line, and the neighbor AS is 65002; the router is in AS 65001, not 65002.

Full explanation →
223
MCQeasy

A network engineer runs the following command on Router R1: R1# show flow interface GigabitEthernet0/1 Interface GigabitEthernet0/1 FNF: monitor Monitor: FLOW-MONITOR-1 direction: Input traffic-statistics: enabled Based on this output, what can be concluded?

A.The flow monitor is applied only to incoming traffic on this interface.
B.The flow monitor is applied to both input and output traffic.
C.Traffic statistics are disabled.
D.The flow monitor is not attached to any interface.
AnswerA

The direction is specified as 'Input', meaning only inbound traffic is monitored.

Why this answer

The output shows that flow monitor FLOW-MONITOR-1 is applied to GigabitEthernet0/1 in the input direction with traffic statistics enabled.

Full explanation →
224
MCQhard

A large enterprise network is experiencing intermittent loss of NetFlow data from multiple routers. Router R1 has the following relevant configuration: flow exporter EXPORTER-1 destination 10.1.1.1 source Loopback0 transport udp 2055 export-protocol netflow-v9. Router R2 shows: R2# show flow exporter EXPORTER-1 statistics | include (Packets|Errors) Packets exported: 0, Errors: 0. The network uses OSPF, and R1's Loopback0 is reachable via a summary route. What is the root cause?

A.The flow exporter is misconfigured with the wrong export protocol; it should be netflow-v5.
B.The collector IP is not reachable due to a missing route; the summary route for Loopback0's subnet does not include the /32 host route.
C.The UDP port 2055 is blocked by an ACL on R1's outbound interface.
D.The flow monitor is not applied to any interface, so no flows are being exported.
AnswerB

If Loopback0's /32 is not in the routing table of the collector's router, packets from that source may be dropped. The summary route may not cover the exact host address.

Why this answer

The issue is that the NetFlow exporter's source interface (Loopback0) is not the same as the interface used to reach the collector (10.1.1.1). OSPF summarization may cause the source IP to be unreachable from the collector's perspective due to routing asymmetry or the summary route not including the specific /32. The correct fix is to ensure the source interface is the one with a route to the collector, or to use a loopback that is explicitly advertised.

Full explanation →
225
MCQeasy

What is the default behavior of a local SPAN session if no direction (rx, tx, both) is specified?

A.Only ingress traffic is monitored.
B.Only egress traffic is monitored.
C.Both ingress and egress traffic are monitored.
D.No traffic is monitored until direction is explicitly set.
AnswerC

This is the default behavior.

Why this answer

If no direction is specified, the default is to monitor both ingress and egress traffic on the source interface.

Full explanation →
Page 2

Page 3 of 27

Page 4

All pages

123456789101112131415161718192021222324252627

Practice 300-410 by domain

Target a specific domain to shore up weak areas.

Layer 3 TechnologiesVPN TechnologiesInfrastructure SecurityInfrastructure Services
See all domains with question counts →